May 2001 - Zope - Zope lists

RE: [Zope] Re: ZEO Client space was:
by sean.upton＠uniontrib.com 28 May '01

28 May '01

Right: there is no box root exploit issue, but if the ODB has a method that connects to your RDB and flushes out a table, in a non-transactional rdb, you are screwed if someone can, from an arbitrary client do this sort of thing. Also, I would think that ZEO CS->ZSS type traffic would be best run on its own switched VLAN for security and performance reasons. Sean -----Original Message----- From: Jerome Alet [mailto:alet@unice.fr] Sent: Friday, May 25, 2001 11:16 AM To: Bill Anderson Cc: zope(a)zope.org Subject: Re: [Zope] Re: ZEO Client space was: On Fri, May 25, 2001 at 11:39:54AM -0600, Bill Anderson wrote: > > So, you give a user you presumably trust, ssh/ssl access to use ZShell. > They comment this code out, or the code that even botehrs to check for > permssion to do anything, and now they now '0WNZ Y0ur z0p3 sist3m'. Except that in this particular case the user would also have to have got filesystem write access to the Extensions directory and a Manager role in /Control_Panel in order for him to be able to comment out the code and restart Zope, because ZShell is currently an external method. Anyway I tend to agree with you, it shouldn't be possible to bypass the security mechanism. bye, Jerome Alet _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

3 2

RE: ZEO Client space was: [Zope] Prerequisites for a desktop IDE, or any desktop app w/Zope
by sean.upton＠uniontrib.com 28 May '01

28 May '01

This makes a lot more sense now; Your client just 'borrows' Zope security mechanisms, and uses them; your GUI platform is Zope with a new UI. In the case of an IDE, this makes sense. The security thing, though, is still a concern, because in a typical enterprise application, you want to be able to grant differing levels of trust and privileges to certain folks; and if they all access the same ODB, what (for example, in the case of an enterprise KM portal) prevents a clever user (let's say, a Python programmer in the company's IT dept) from being able to bypass the client security mechanism and get access to HR or payroll data that he/she is not supposed to see? You could do host-based security, use a firewall, and limit access in certain ways, but this still won't get you what you need. You could use encryption, but the issues are still the same. In most RDB-based client apps, a client libraries are set up on the users' machines by company IT staff, who set passwords for certain types of access; control over authentication mechanisms happens on a server, which is under control of a restricted group of people. I guess, if you are just looking for applications that access data and call methods written in Zope, XML-RPC would still be ideal, and have the security features that would be needed. There is another advantage to using XML-RPC: XML transactions can be brokered. Suppose we are trying to create a newspaper editorial CMS-like system, which stores news stories for different "desks" at a newspaper: ['news', 'features', 'sports']. You have a diverse web farm of 6 nodes, composed of 3 clusters ZEO clients (2 machines each, all nodes access a single ZSS); each of these ZEO groups handles content and databases for each "desk." All of these desks access content through XML-RPC from fat clients. In this case, we want to be able to create a single virtual server out of these; use a product like an Intel 7210 XML accelerator, and you can loadbalance+direct traffic to the correct server by creating some XPath queries of the request XML to see what database they are trying to access, or what method they are calling, etc. This would also allow us to speed things up and do things like authenticate stuff in the "sports" database off of one LDAP server set up for sports writers, and "news" off another. I understand that this wouldn't address parsing and marshalling latency, but it seems like a good way to have a big application with many GUI clients set up. I know that this way we don't have access to as rich of an object set, or acquisition, etc, but it seems like for most GUI apps, this would be a reasonable thing to give up (for the time being, at least) to have the flexibility and simplicity of using XML-RPC. So, some might ask the question: why create a client that simply treats Zope remote methods as a "dumb" data source? I'm not sure that a dumb transport necessarily makes for an unintelligent application; it just means the application is a little bit more autonomous from Zope (which could either be good or bad)... Sean -----Original Message----- From: Michel Pelletier [mailto:michel@digicool.com] Sent: Thursday, May 24, 2001 9:25 PM To: tim(a)freepm.org Cc: zope(a)zope.org Subject: Re: ZEO Client space was: [Zope] Prerequisites for a desktop IDE, or any desktop app w/Zope On Thu, 24 May 2001, Tim Cook wrote: > Michel Pelletier wrote: > > > XMLRPC could do this, but I'm afraid it would be seriously > > limited. XMLRPC is very useful, but it does not map as well as it could > > onto the python object model. I would prefer to see a GUI client running > > in the same process space as a ZEO client, this way the GUI client could > > do everything that Zope could do and re-use alot of the existing > > interfaces (like security, acquisition, script objects, etc). > > > > Michel, > I took this off list because it was off topic for the thread. But > feel free to Cc it back if you feel it's important. I think it > was covered a few weeks ago on the -dev list but couldn't locate > it. It's not off topic so I'm cc:ing the list. > Anyway, the question is: I thought I had read that using ZEO > basically by-passed the Zope security model? Maybe I was thinking > of direct ZODB access? This is a good question. Using ZEO does bypass the Zope security model, but then again, Zope bypasses the Zope security model. Zope is, essentially, a client that implements an application on top of a persistent database. Why can't your client do the same thing? Zope enforces security upon its users using tested, re-usable interfaces. You're should essentially change the user interface to the Zope core code by making it call wxPython widgets or whatever instead of spewing HTML to a browser over a socket. If this GUIfied ZEO client ran on the same machine as the server, it would actually be safer than a "real" Zope ZEO client, which is exposed to the web. We use ZEO clients to access Zope through many different interfaces, not necessarily all of them over a network, or running in a context we don't trust. We use ZEO clients to debug zope from the command line, to serve just FTP or a monitor server, and each different way of doingit is just a shim on top of the core Zope interfaces. By going with xml-rpc, you'll be shoving *very* rich interface semantics of a full blown windowing sytem down the tiny semantic straw of xml-rpc, to try and manipulate interfaces that were originally indented to be used by medium to poor semantic HTML interfaces. If you use a ZEO client, there are no bottle necks. You could render the object system in 3D OpenGL if you wanted to, and still enforce the user. Jerome's ZShell script shows how this can be done safely. His shell is essentialy just another interface to the Zope core code. It would be very dangerous if it did not use Zope's security API to restrict its actions. In zshell's case, the interface is really simple, a command line. It is probably not as safe to to grant access to this command line over unprotected networks. and it would be unsafe to expose a GUIfied ZEO client to unprotected networks, but this is easily mitigatable with things like ssh or ssl. -Michel _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

2 1

Re: ZEO Client space was: [Zope] Prerequisites for a desktop IDE, or any desktop app w/Zope
by Michel Pelletier 28 May '01

28 May '01

On Thu, 24 May 2001, Tim Cook wrote: > Michel Pelletier wrote: > > > XMLRPC could do this, but I'm afraid it would be seriously > > limited. XMLRPC is very useful, but it does not map as well as it could > > onto the python object model. I would prefer to see a GUI client running > > in the same process space as a ZEO client, this way the GUI client could > > do everything that Zope could do and re-use alot of the existing > > interfaces (like security, acquisition, script objects, etc). > > > > Michel, > I took this off list because it was off topic for the thread. But > feel free to Cc it back if you feel it's important. I think it > was covered a few weeks ago on the -dev list but couldn't locate > it. It's not off topic so I'm cc:ing the list. > Anyway, the question is: I thought I had read that using ZEO > basically by-passed the Zope security model? Maybe I was thinking > of direct ZODB access? This is a good question. Using ZEO does bypass the Zope security model, but then again, Zope bypasses the Zope security model. Zope is, essentially, a client that implements an application on top of a persistent database. Why can't your client do the same thing? Zope enforces security upon its users using tested, re-usable interfaces. You're should essentially change the user interface to the Zope core code by making it call wxPython widgets or whatever instead of spewing HTML to a browser over a socket. If this GUIfied ZEO client ran on the same machine as the server, it would actually be safer than a "real" Zope ZEO client, which is exposed to the web. We use ZEO clients to access Zope through many different interfaces, not necessarily all of them over a network, or running in a context we don't trust. We use ZEO clients to debug zope from the command line, to serve just FTP or a monitor server, and each different way of doingit is just a shim on top of the core Zope interfaces. By going with xml-rpc, you'll be shoving *very* rich interface semantics of a full blown windowing sytem down the tiny semantic straw of xml-rpc, to try and manipulate interfaces that were originally indented to be used by medium to poor semantic HTML interfaces. If you use a ZEO client, there are no bottle necks. You could render the object system in 3D OpenGL if you wanted to, and still enforce the user. Jerome's ZShell script shows how this can be done safely. His shell is essentialy just another interface to the Zope core code. It would be very dangerous if it did not use Zope's security API to restrict its actions. In zshell's case, the interface is really simple, a command line. It is probably not as safe to to grant access to this command line over unprotected networks. and it would be unsafe to expose a GUIfied ZEO client to unprotected networks, but this is easily mitigatable with things like ssh or ssl. -Michel

4 3

Passing a string argument by URL to a Z SQL Method
by Ben Gustafson 28 May '01

28 May '01

I'm working on Chapter 10 of the Zope Book (Relational Database Connectivity), and have had problems passing a string argument by URL to a Z SQL Method, although I was able to implement the example in the book of passing an integer argument by URL. My test is as follows: 1) I have a Z SQL Method named list_reqs, located at http://localhost:8080/Zoo/Employees/Departments: Arguments: department_id SQL: select * from requisitions where <dtml-sqltest department_id op=eq type=string> When I test the Method, I get these results: -- DEPARTMENT ID REQ ID DESCRIPTION UNIT COST QUANTITY Sales 1 paper clips 10.0 1000 Sales 2 golf clubs 500.0 10 Sales 4 staples 10.0 500 ---------------------------------------------------------------- SQL used: select * from requisitions where department_id = 'Sales' -- Under the Advanced tab of the Method, I have the "Allow 'simple' direct traversal" box checked. 2) I have a DTML Method named reqs, located in the same folder as the list_reqs Z SQL Method. I call the DTML Method on the Z SQL Method and attempt to pass it Sales as the department_id using this URL: http://localhost:8080/Zoo/Employees/Departments/list_reqs/Sales/reqs. When I do so, I get the following error: -- Site Error An error was encountered while publishing this resource. Debugging Notice Zope has encountered a problem publishing your object. Cannot locate object at: http://localhost:8080/Zoo/Employees/Departments/list_reqs/Sales -- Is there a reason why Zope won't accept the Sales ID in the URL as an argument, but instead tries to access it as a folder? The obvious workaround is to use an integer for the Department ID instead of a varchar, but that would make the URL less readable. Besides, I want to do it this way!

1 0

newbie: add Frontpage & Word files
by Milos Prudek 28 May '01

28 May '01

I need to clarify: What is the best way to convert Word documents to plain HTML, including pictures and non-english characters? What is the best way to convert FrontPage documents (strip away html head and body tags, JavaScript, frames etc. so that it can be safely included as HTML snippet)? Is there a product to do it, or do I have to write it in Python? -- Milos Prudek

3 2

/standard_error_message
by Chris Ryland 28 May '01

28 May '01

There's something very funny going on with the stock Zope 2.3.0 /standard_error_message method. It seems to be recursively reproduced by some outside, non-obvious code that's calling it, but only after first outputting its own error message. (I.e., my standard_html_header and _footer are by no means the first nor last thing in the output.) If I change it to do what I think would help, it just gets worse. Can someone clear this up? It looks like black magic to this Zope neophyte. -- Cheers! Chris Ryland Em Software, Inc. www.emsoftware.com

1 0

Problem in multiple selection type attributs
by Dominique Jouniot 28 May '01

28 May '01

Hello, I am trying to use the multiple selection type attributs in a Zclass object definition. I want to use a method who return a list and accept arguments. The method is sutauted in a subfolder of my main site but not in the definition of the Zclass Object. By example : mainsite ---Family----Object | --parameter---method The method in parameter return a python list. The attribut type multiple selection is in the Object definition 1) I want to know the syntax in the attribut value part i must put to obtain a result different from no value for xxx I try : methods (doesn't work) parameter.method (id) parameter/method (id) /mainsite/parameter/method mainsite.parameter.method no solution are working !! 2) in reality, i want to complicate the problem, and i want to use a method in a other type of object (called Critera) which return the list of values. In thsi case in parametre, i will have a list of Critera Object. In that case which is the syntax? is it possible ? 3) has someone an idea how we can dump the contents of the context, namespace and request of an object (attribut, etc) because this point seems reaaly difficult to understand in zope. Thanks for your help Best regards Dominique

1 0

newbie: add Frontpage & Word files
by Milos Prudek 28 May '01

28 May '01

Hi, What is the best way to allow users add FrontPage documents (strip away html head and body tags)? Is there a product to do it, or do I have to write it in Python? And the same question for Word files, including pictures AND non-english characters? -- Milos Prudek

1 0

Passing a variable number of parameters to a Python script
by Bruce Pearson &/or Gwyn Ingham 28 May '01

28 May '01

Hi, I wonder if anyone can help me. I have a python script in which I want to accept a variable number of parameters from a post method. ie http://Localhost:8080/apply?count=2&param0=abc&param1=xyz or http://Localhost:8080/apply?count=4&param0=abc&param1=123&param2=rst&param3= xyz I want to access the parameters as a list something like this: PythonScript apply(count, *args) print count for arg in args print arg Thanks Bruce.

3 4

RE: [Zope] Cannot get to management screens! (stuck in view page)
by Etienne Labuschagne 28 May '01

28 May '01

I wonder what is causing it and if it really is a problem of the browsers and not maybe something in Zope that was previously "tolerated" but now causes errors. I really hope this will be resolved because, even though I am not a great Microsoft fan (I use StarOffice eg.), I think Netscape (on Windows anyway) has much more problems than IE. Whenever I use save (saving DTML source code etc.) Netscape takes an age before the next page is loaded, all the while Nuking my processor. I don't know if NS6 is better, but I hear it is VERY buggy. Etienne -----Original Message----- From: John Warburton [mailto:linux@billabong.demon.co.uk] Sent: Monday, May 28, 2001 1:42 PM To: zope Subject: Re: [Zope] Cannot get to management screens! (stuck in view page) I am seeing this problem in Mozilla latest CVS version too. John -- http://johnwarburton.net/ _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

2 1